Every request (except the public payment-return redirect) is authenticated with a
business’s API key.
Getting a key
An admin registers your business with POST /api/v1/businesses. The response contains the
plaintext api_key exactly once — only its SHA-256 hash is stored, so it cannot be
retrieved later. If you lose it, rotate (below) to issue a new one.
Sending the key
Pass it on every request using either header:
A missing, unknown, or disabled key returns 401 Unauthorized. All data you access is
automatically scoped to your business.
Rotating the key
Rotate your own key with the self-service endpoint (the old key stops working immediately):
The response returns the new api_key once. See Managing businesses.
Treat the API key like a password. Never embed it in client-side code or commit it to
source control. Use it only from your server.